Quantum key distribution method and communication device

ABSTRACT

In order to create a highly-secured common key while a data error on a transmission path is corrected by an error correction code having remarkably high characteristics, in a quantum key distribution method of the invention, at first a communication apparatus on a reception side corrects the data error of reception data by a deterministic, stable-characteristics parity check matrix for a “Irregular-LDPC code.” The communication apparatus on the reception side and a communication apparatus on a transmission side discard a part of pieces of the common information according to public error correction information.

TECHNICAL FIELD

The present invention relates to a quantum key distribution method withwhich it is possible to create a highly-secured common key, andparticularly to the quantum key distribution method with which it ispossible correct data error by an error correction code, and to acommunication apparatus that can realize the quantum key distribution.

BACKGROUND ART

A conventional quantum cryptosystem is described below. Recently,optical communications, which allow high-speed, large-capacitycommunication, have been widely used. In such an optical communicationsystem, the communication is performed by turning a light beam on andoff. When the light beam is turned on, a large quantity of photons aretransmitted, so that such optical communication system does not directlyproduce the quantum effect.

On the other hand, in the quantum cryptosystem, the photon is used as acommunication medium, and information of one bit is transmitted by onephoton so that the quantum effect such as the uncertainty principle isgenerated. If a person who wants to tap the communication (hereinafter,“interceptor”) randomly selects a base to measure the photon withoutknowing a quantum state such as a phase, the quantum state is changed.Therefore, on a receiver side, it is possible to recognize whethertransmission data is intercepted by confirming the change in quantumstate of the photon.

FIG. 9 is an overview of a conventional quantum key distributionutilizing polarization. For example, a measuring apparatus, which canidentify the light polarized in a horizontal direction from the lightpolarized in a vertical direction, correctly identifies the lightpolarized in the horizontal direction (0°) on a quantum communicationpath from the light polarized in the vertical direction (90°) on thequantum communication path. On the other hand, another measuringapparatus, which can identify the light polarized in an obliquedirection (45°, 135°), correctly identifies the light polarized in theoblique direction of 45° on a quantum communication path from the lightpolarized in the oblique direction of 135° on the quantum communicationpath.

As described above, each measuring apparatus can correctly recognize thelight polarized in the specified direction. However, when the lightpolarized in the oblique direction is measured with the measuringapparatus that can identify the light polarized in the horizontaldirection from the light polarized in the vertical direction, theapparatus recognizes the light polarized in the horizontal direction(0°) and the light polarized in the vertical direction (90°) with theprobability of 50% respectively. Namely, when a measuring apparatus thatdoes not match the identifiable polarized direction is used, even if themeasurement result is analyzed, the polarized direction cannot becorrectly identified.

In the quantum key distribution shown in FIG. 9, by utilizing theuncertainty (randomness), a person who transmits the data (transmitter)and a person who receives the data (receiver) share a key without beingknown by the interceptor (Patent Literature 1). The transmitter and thereceiver can also use a public communication path in addition to thequantum communication path. A procedure of sharing the key is described.

The transmitter first generates a random number sequence (sequence of 1and 0: transmission data) and randomly chooses a transmission code (+:the code corresponding to the measuring apparatus that can identify thelight polarized in the horizontal direction from the light polarized inthe vertical direction, and ×: the code corresponding to the measuringapparatus that can identify the light polarized in the obliquedirection). The combination of the random number sequence and thetransmission code can automatically set the polarized direction of thetransmitted light. In this case, the light polarized in the horizontaldirection by the combination of 0 and +, the light polarized in thevertical direction by the combination of 1 and +, the light polarized inthe 45° direction by the combination of 0 and ×, and the light polarizedin the 135° direction by the combination of 1 and × are transmitted tothe quantum communication path (transmission signal).

The receiver randomly chooses a reception code (+: the codecorresponding to the measuring apparatus that can identify the lightpolarized in the horizontal direction from the light polarized in thevertical direction, and ×: the code corresponding to the measuringapparatus that can identify the light polarized in the obliquedirection) and measures the light on the quantum communication path(reception signal). The receiver obtains reception data by thecombination of the reception code and the reception signal. In thiscase, 0 is obtained as the reception data by the combination of thelight polarized in the horizontal direction and +, 1 is obtained as thereception data by the combination of the light polarized in the verticaldirection and +, 0 is obtained as the reception data by the combinationof the light polarized in the 45° direction and ×, and 0 is obtained asthe reception data by the combination of the light polarized in the 135°direction and ×.

The receiver then transmits the reception code to the transmitterthrough the public communication path in order to check whether thereceiver has performed a measurement with an appropriate measuringapparatus. Having received the reception code, the transmitter checkswhether the measurement of the receiver has been performed with anappropriate measuring apparatus. The transmitter transmits the result tothe receiver through the public communication path.

The receiver then saves (keeps behind) only the reception datacorresponding to the reception signal which is received with theappropriate measuring apparatus, and discards other pieces of thereception data. At this point, the transmitter and the receiver cansecurely share the saved reception data.

The transmitter and the receiver then transmit the predetermined numberof pieces of data selected from the common data to each other throughthe public communication path. The transmitter and the receiver confirmwhether the received data corresponds to the data owned by oneself. Forexample, when even one piece of the confirmed data does not correspondto the data owned by the transmitter or the receiver, judging that theinterceptor is present, they discard the common data and perform theprocess of sharing the key again from the start. On the other hand, whenthe confirmed data completely corresponds to the data owned by thetransmitter or the receiver, judging that there is no interceptor, thetransmitter and the receiver discard the data used for the confirmation,and the saved common data becomes the common key for the transmitter andthe receiver.

Application of the conventional quantum key distribution method includesthe quantum key distribution method that can correct data error on atransmission path.

In the method, in order to detect the data error, the transmitterdivides the transmission data into a plurality of blocks and transmitsparity in each block onto the public communication path. The receivercompares the parity in each block received through the publiccommunication path, to the parity of the corresponding block in thereception data and checks the data error. When a different parity ispresent, the receiver transmits a reply of the information indicatingwhich parity of the block is different onto the public communicationpath. The transmitter further divides the appropriate block into a firsthalf block and a second half block and transmits, for example, the firsthalf parity onto the public communication path (binary search). Thetransmitter and the receiver then specify a position of an error bit byrepeating the binary search, and the receiver finally corrects thespecified bit.

Assuming that it is determined that a parity is correct due to evennumber of errors even if an error is present in the data, thetransmitter randomly permutates the transmission data (randompermutation) to divide the transmission data into a plurality of blocksand performs the error correction processing by the binary search again.All the data errors are corrected by repeatedly executing the errorcorrection processing by the random permutation.

Patent Literature 1: Bennett. C. H. and Brassard, G.: QuantumCryptography: Public Key Distribution and Coin Tossing, In Proceedingsof IEEE Conference on Computers, System and Signal Processing,Bangalore, India, pp. 175-179 (DECEMBER 1984).

Patent Literature 2: Brassard, G. and Salvail, L. 1993 Secret-KeyReconciliation by Public Discussion, In Advances in Cryptology—EUROCRYPT'93, Lecture Notes in Computer Science 765, 410-423.

In the conventional quantum key distribution shown in FIG. 9, however,an error communication path is not considered. When an error is present,the common data (common key) is discarded because an intercepting actionis presumed to be present. Therefore, there is a problem that creationefficiency of the common key is correspondingly affected in sometransmission paths.

In the quantum key distribution method that can correct the data erroron the transmission path, huge number of exchanges of the parity isgenerated for specifying the error bit, and the error correctionprocessing is also performed in a predetermined times by the randompermutation. Therefore, there is a problem that a long period of time isrequired for the error correction processing.

It is an object of the present invention to provide a quantum keydistribution method that can create a highly-secured common key whilecorrecting data error on a transmission path by an error correction codehaving remarkably high characteristics.

DISCLOSURE OF THE INVENTION

A quantum key distribution method according to the present invention isemployed on a quantum cryptosystem including a first communicationapparatus that transmits photons onto a quantum communication path and asecond communication apparatus that measures the photons. The methodincludes, for example, a check matrix creation step of each of the firstcommunication apparatus and the second communication apparatus creatingthe same parity check matrices H(n×k); a random number generation stepof the first communication apparatus generating a random number sequence(transmission data) and randomly determining a predeterminedtransmission code (base) by the first communication apparatus, and thesecond communication apparatus randomly determining a predeterminedreception code (base); a photon transmission step of the firstcommunication apparatus transmitting a photon onto the quantumcommunication path while the photon is in a quantum state specified by acombination of the transmission data and the transmission code; a photonreception step of the second communication apparatus measuring thephoton transmitted on the quantum communication path to obtain receptiondata specified by the combination of the reception code and measurementresult; a data deletion step of each of the first communicationapparatus and the second communication apparatus deciding whether themeasuring has been performed with an appropriate measuring apparatus,saving the reception data of n bits if the measuring has been performedwith the appropriate measuring apparatus and transmission data thatcorresponds to the reception data, and discarding other pieces of thedata; an error correction information notification step of the firstcommunication apparatus notifying the second communication apparatusthrough a public communication path of error correction information of kbits based on the parity check matrix H and the transmission data of nbits; an error correction step of the second communication apparatuscorrecting the error of the reception data based on the parity checkmatrix H, the reception data of n bits, and the error correctioninformation; and a cryptographic key creation step of each of the firstcommunication apparatus and the second communication apparatusdiscarding a part (k) of pieces of the common information (n) aftercorrection according to public error correction information, creating acryptographic key using information that has remained after discarding,and setting the cryptographic key as a common key which is sharedbetween apparatuses.

According to the invention, the data error of the common information iscorrected by a deterministic and stable-characteristics parity checkmatrix for “Irregular-LDPC code”, and a part of the common informationis discarded depending on the public error correction information.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a configuration of a quantum cryptosystem according to afirst embodiment of the invention; FIGS. 2A and 2B are flowcharts of aprocess procedure for the quantum key distribution according to thefirst embodiment; FIG. 3 is a flowchart of forming “Irregular-LDPC code”based on finite affine geometry; FIG. 4 depicts a matrix of finiteaffine geometry code AG (2, 2²); FIG. 5 depicts a final weightdistribution of column λ(γ_(i)) and a final weight distribution of rowρ_(u); FIG. 6 depicts a division procedure performed by a Latin squarematrix of a random sequence; FIG. 7 depicts a configuration of a quantumcryptosystem according to a second embodiment of the invention; FIG. 8is a flowchart of a quantum key distribution of the second embodiment ofthe invention; and FIG. 9 is an overview of a conventional quantum keydistribution.

BEST MODE FOR CARRYING OUT THE INVENTION

Exemplary embodiments of a quantum key distribution method according tothe present invention are described with reference to the accompanyingdrawings. It should be noted that the invention is not limited to theexemplary embodiments. Although a quantum key distribution utilizing apolarized light is described below as an example, the invention can bealso applied to the quantum key distribution utilizing a phase, thequantum key distribution utilizing a frequency, and the like, and theinvention does not particularly limit what quantum state is utilized.

FIRST EMBODIMENT

The quantum key distribution is a key distribution method, which issecurity-guaranteed regardless of computational ability of interceptors.However, for example, in order to create a common key more efficiently,it is necessary to remove the data error generated when the data passesthrough the transmission path. Therefore, the quantum key distributionwhich performs the error correction by a Low-Density Parity-Check (LDPC)code is described in this embodiment. It is known that the LDPC code hasremarkably high characteristics.

FIG. 1 depicts a configuration of the communication apparatus(transmission device and receiving device) in the quantum cryptosystemaccording to the first embodiment of the invention. The quantumcryptosystem includes the communication apparatus on the transmissionside having a function of transmitting information m_(a) and thecommunication apparatus on the reception side having the function ofreceiving information m_(a) which is affected by a noise or the like onthe transmission path, i.e. information m_(b).

The communication apparatus on the transmission side includes acryptographic key creation unit 1 and a communication unit 2. Thecryptographic key creation unit 1 transmits the information m_(a)through the quantum communication path, transmits a syndrome S_(A)through the public communication path, and creates a cryptographic key(common key with the reception side) based on the information m_(a) andthe syndrome S_(A). In the communication unit 2, an encryption unit 21encrypts the data based on the cryptographic key and a transmission andreceiving unit 22 exchanges the data through the public communicationpath. The communication apparatus on the reception side includes acryptographic key creation unit 3 and a communication unit 4. Thecryptographic key creation unit 3 receives the information m_(b) throughthe quantum communication path, receives the syndrome S_(A) through thepublic communication path, and creates the cryptographic key (common keywith the transmission side) based on the information m_(b) and thesyndrome S_(A). In the communication unit 4, an encryption unit 42encrypts the data based on the cryptographic key and a transmission andreceiving unit 41 exchanges the data through the public communicationpath.

In the communication apparatus on the transmission side, the lightpolarized in the predetermined direction with a polarization filter (seeFIG. 9) is transmitted as the information m_(b) transmitted onto thequantum communication path to the communication apparatus on thereception side. On the other hand, in the communication apparatus on thereception side, the light polarized in the horizontal direction (0°) onthe quantum communication path, the light polarized in the verticaldirection (90°) on the quantum communication path, the light polarizedin the oblique direction of 45° on the quantum communication path, andthe light polarized in the oblique direction of 135° on the quantumcommunication path are identified by the measuring apparatus that canidentify the light polarized in the horizontal direction (0°) from thelight polarized in the vertical direction (90°) and the measuringapparatus that can identify the light polarized in the oblique direction(45°) from the light polarized in the oblique direction (135°). Eachmeasuring apparatus can correctly recognize the light which is polarizedin the specified direction. However, when the light polarized in theoblique direction is measured with the measuring apparatus that canidentify the light polarized in the horizontal direction (0°) from thelight polarized in the vertical direction (90°), the measuring apparatusrecognizes the light polarized in the horizontal direction and the lightpolarized in the vertical direction with the probability of 50%respectively. Namely, when the measuring apparatus that does not matchthe identifiable polarized direction is used, even if the measurementresult is analyzed, the polarized direction cannot be correctlyidentified.

The operation of each communication apparatus in the quantumcryptosystem, i.e., the quantum key distribution according to theembodiment is described in detail below. FIGS. 2A and 2B are flowchartsof a process procedure for the quantum key distribution according to thefirst embodiment, particularly FIG. 2A depicts a process procedureperformed by the communication apparatus on the transmission side andFIG. 2B depicts a process procedure performed by the communicationapparatus on the reception side.

In the communication apparatus on the transmission side and thecommunication apparatus on the reception side, parity check matrixcreation units 10 and 30 obtain a parity check matrix H(n×k) of aspecific linear code, a creation matrix G((n−k)×n) satisfying “HG=0”from the parity check matrix H, and an inverse matrix G⁻¹(n×(n−k)) ofthe creation matrix G, and further obtain the inverse matrix G⁻¹satisfying G⁻¹·G=I (unit matrix) (step S1 and step S11). The quantum keydistribution of an instance that the LDPC code having the excellentcharacteristics extremely close to Shannon limit is used as the specificlinear code is described in this embodiment. The LDPC code is used asthe error correction method in this embodiment. This embodiment is notlimited to the LDPC code, and it is also possible to use other linearcodes such as a turbo code. Further, as long as error correctioninformation (syndrome) described later is an error correction protocolexpressed by a product Hm_(A) of a proper matrix H and information m_(A)(for example, the error correction protocol corresponding to “thequantum key distribution which can correct the data error on thetransmission path” described in the Background art), namely as long asthe linearity of the error correction information and the linearity ofthe information m_(A) are secured, the matrix H may be used as thespecific linear code.

A method of forming the LDPC code in the parity check matrix creationunit 10, particularly the method of forming an “Irregular-LDPC code”based on affine finite geometry (Details of step S1 in FIG. 2) isdescribed. The description of the parity check matrix creation unit 30is omitted because the operation of the parity check matrix creationunit 30 is identical as the parity check matrix creation unit 10. Inthis embodiment, check matrix creation processing may be configured tobe performed according to a set parameter by the parity check matrixcreation unit 10, or the check matrix creation processing may beconfigured to be performed by other control units (such as a computer)outside the communication apparatus. When the check matrix creationprocessing in this embodiment is performed outside the communicationapparatus, the already created check matrix is stored in thecommunication apparatus. An instance of the above processing beingperformed by the parity check matrix creation unit 10 is describedbelow.

The parity check matrix creation unit 10 selects a finite affinegeometry code AG(2,2^(S)) which becomes a base of the check matrix for“Irregular-LDPC code” (FIG. 3, step S21). In this case, a weight of arow and the weight of a column become 2^(S), respectively. FIG. 4depicts, for example, the matrix of the finite affine geometry code AG(2, 2²) (a blank in the matrix indicates 0).

The parity check matrix creation unit 10 then determines a maximum valuer₁ (2<r_(l)≦2^(S)) of the weight of the column (step S22). The paritycheck matrix creation unit 10 also determines a coding rate (1-syndromelength/key length) (step S22),

The parity check matrix creation unit 10 then uses optimization ofGaussian approximation and tentatively determines a weight distributionof the column λ(γ_(i)) and a weight distribution of the row ρ_(u) (stepS23). A creation function ρ(x) of the weight distribution of the row isset to ρ(x)=ρ_(u)x^(u−1)+(1−ρ_(u))x^(u). A weight u is an integer ofu≧2, and ρ_(u) indicates a portion of the weight u in the row.

The parity check matrix creation unit 10 selects the weight of the row{u, u+1} which can be formed by dividing the row of the finite affinegeometry, and determines a division coefficient {b_(u), bu₊₁} whichsatisfies the following equation (1), where b_(u) and b_(u+1) are anon-negative integer (step S24).b _(u) +b _(u+1)(u+1)=2^(s)   (1)

Specifically, b_(u+1) is determined from the equation (1) afterdetermining b_(u) from:

$\begin{matrix}{\text{arg} \cdot {\min\limits_{bu}{{\varphi_{u} - \frac{u \times b_{u}}{2^{s}}}}}} & (2)\end{matrix}$

The parity check matrix creation unit 10 then determines the weightdistributions ρ_(u)′ and ρ_(u+1)′ of the row updated by the determinedparameters u, u+1, b_(u), and b_(u+1) (by the row division processingmentioned above) from (step S25):

$\begin{matrix}{{\varphi_{u}^{\prime} = \frac{u \times b_{u}}{2^{s}}}{\varphi_{u + 1}^{\prime} = \frac{\left( {u + 1} \right) \times b_{u + 1}}{2_{s}}}} & (3)\end{matrix}$

The parity check matrix creation unit 10 then uses the optimization ofGaussian approximation, sets u, u+1, ρ_(u)′, and ρ_(u+1)′ determined bythe calculation to the fixed parameter, and tentatively determines theweight distribution of the column λ(γ_(i)) (step S26). The weight γ_(i)is an integer of γ_(l)≧2, and λ(γ_(i)) indicates a portion of the weightγ_(i) in the column. The parity check matrix creation unit 10 alsodeletes the weight in which the number of column is not more than 1(λ(γ_(i))≦γ_(i)/w_(t), i is a positive integer) from candidates.However, w_(t) indicates the total number of 1 included in AG(2,2^(S)).

The parity check matrix creation unit 10 then selects a set of a weightcandidate of the column {γ₁, γ₂, . . . γ_(l) (γ_(l)≦2^(S))} whichsatisfies the weight distribution determined above and the followingequation (4) (step S27). When the weight of the column γ_(i), which doesnot satisfy the following equation (4), is present, it is deleted fromthe candidates.

$\begin{matrix}{{\begin{bmatrix}a_{1,1} & a_{1,2} & \cdots & a_{1,l} \\a_{2,1} & a_{2,2} & \cdots & a_{2,l} \\\vdots & \; & \cdots & \vdots\end{bmatrix}\begin{bmatrix}\gamma_{1} \\\gamma_{2} \\\vdots \\\gamma_{l}\end{bmatrix}} = \begin{bmatrix}2^{s} \\2^{s} \\\vdots \\2^{s}\end{bmatrix}} & (4)\end{matrix}$

In equation 4, “a” indicates the coefficient which becomes anon-negative integer to {γ₁, γ₂, . . . γ_(l)} for forming the weight ofthe column 2^(S), i and j are positive integers, γ_(i) indicates theweight of the column, and γ_(l) indicates the maximum weight of thecolumn.

The parity check matrix creation unit 10 then uses the optimization ofGaussian approximation, sets u, u+1, ρ_(u)′, ρ_(u+1)′, and {γ₁, γ₂, . .. , γ_(l)} determined above to the fixed parameter, and determines theweight distribution λ(γ_(i)) and the weight distribution of the rowρ_(u) (step S28).

The parity check matrix creation unit 10 then adjusts the weightdistribution of the column λ(γ_(i)) and the weight distribution of therow ρ_(u) before the division processing (step S29). Each weightdistribution after the adjustment is set to a value close to the valuedetermined by Gaussian approximation as much as possible. FIG. 5 depictsa final weight distribution of column λ(γ_(i)) and the final weightdistribution of row ρ_(u).

Finally, the parity check matrix creation unit 10 divides the row andthe column in the finite affine geometry (step S30) and creates theparity check matrix H of n×k. In the division processing of the finiteaffine geometry code in the invention, the finite affine geometry codeis not regularly divided, but the number of “1” is randomly extractedfrom each row or each column (see the specific example of randomdivision described later). Any method can be used as the extractionprocessing as long as the randomness is held.

Specifically, when the row number of “1” in the first row in EG(2,2⁵) isexpressed as: B₁(x)={1 32 114 136 149 223 260 382 402 438 467 507 574579 588 622 634 637 638 676 717 728 790 851 861 879 947 954 971 977 979998}; the number of “1” is randomly extracted from B₁(x), and, forexample the first row to the fourth row R_(m)(n) in the matrix after thedivision become as follows:

R₁(n)={1 114 574 637 851 879 977 979}

R₂(n)={32 136 402 467 588 728 861 971}

R₃(n)={149 260 382 438 579 638 717 998}

R₄(n)={223 507 622 634 676 790 947 954}.

An example of the random division, i.e. the “division method using aLatin square matrix of a random sequence” is described in detail below.When the random division is performed, the random sequence is easily anddeterministically created. The advantage of this method is that thetransmission side and the reception side can create-the same randomsequence. The procedure of the division method is as follows:

-   -   (1) The basic random sequence is prepared. At this point, the        finite affine geometry AG(2,2^(S)) is used, and the basic random        sequence C(i) is prepared according to the equation (5) when P        is set to a minimum prime number satisfying P≧2^(S).        C(1)=1        C(i+1)=G ₀ ×C(i) mod P   (5)

Where i=0, 1, . . . , P−2, and G_(0′) is a primitive element of Galoisfield GF(P). The number larger than 2^(S) is deleted from C(i) so that aseries length becomes 2^(S), and C(i) after the deletion is set to thebasic random sequence.

-   -   (2) A skip interval S(j) for reading the basic random sequence        C(i) at a constant interval is defined as:        S(j)=j j=1, 2, . . . , 2^(s)   (6)    -   (3) A permutation pattern LB_(j)(i) is prepared by:        LB_(j)(i)=((S(j)×i) mod P)+1        j=1, 2, . . . , 2^(s)        i=1, 2, . . . , P−1   (7)        The number larger than 2^(S) is deleted from LB_(j)(i).    -   (4) A jth Latin square matrix L_(jp)(i) defined by q columns and        i rows is calculated by:        L _(jq)(i)=LB_(j)(((q+i−2) mod 2^(s))+1)        j=1, 2, . . . , 2^(s)        i=1, 2, . . . , 2^(s)        q=1, 2, . . . , 2^(s)   (8)    -   (5) The column and the row are divided according to the Latin        square matrix L_(jp)(i). In the division of the column, g₀, g₁,        . . . , g_(n−1) is set to a column vector of the parity check        matrix H, and g_(c)′(k) is set to kth “1” in the column of g_(c)        (c=0, 1, . . . , n−1). A set of positions of “1” in g_(c) is set        to G_(c) (see equation (9)).        G _(c) ={g _(c)′(k), k=1, 2, . . . , 2^(s)}  (9)        For example, the row number of “1” in the column of c=1-st of        AG(2, 2³) becomes G₁={1 3 8 20 23 24 34 58}. When the c-th        column vector is expressed by g_(c)′(k), the c-th column vector        can be expressed by:        g _(c)′(1)=((c−1)+1)mod(2^(2s)−1)        g _(c)′(2)=(g _(c)′(1)+2)mod(2^(2s)−1)        g _(c)′(3)=(g _(c)′(2)+5)mod(2^(2s)−1)        g _(c)′(4)=(g _(c)′(3)+12)mod(2^(2s)−1)        g _(c)′(5)=(g _(c)′(4)+3)mod(2^(2s)−1)        g _(c)′(6)=(g _(c)′(5)+1)mod(2^(2s)−1)        g _(c)′(7)=(g _(c)′(6)+10)mod(2^(2s)−1)        g _(c)′(8)=(g _(c)′(7)+24)mod(2^(2s)−1)   (10)

At this point, each column g_(c) of the parity check matrix H is dividedinto the new column g_(c,e) based on a degree and the coefficient of thecolumn satisfying the equation (4). g_(c,e)′(r) is set to “1” of ther-th row in the new column g_(c,e) (see equation (11)).G _(c,e) ={g _(c,e)′(r), r=1, 2, . . . }  (11)

An edge which is divided according to the following equation (12) isselected by the Latin square matrix group. Where a_(t,1), a_(t,2), . . ., a_(t,l) and γ₁, γ₂, . . . , γ_(l) are the coefficient and the degreewhich satisfy the equation (4) respectively, and, t indicates the rownumber of a coefficient matrix. When the column number of the finiteaffine plane divided by the equation of the tth row is set to n_(t) andthe maximum value of the row number of the coefficient matrix is set tot_(m), t can be expressed by the following equation (13).

$\begin{matrix}{{{g_{c,e}^{\prime}(r)} = {g_{c}^{\prime}\left( {L_{j,q}(i)} \right)}}{j = {c/2^{s}}}{q = {\left( {\left( {c - 1} \right)\text{mod}\; 2^{s}} \right) + 1}}i = {r + {\sum\limits_{m = 1}^{l}\;{{\min\left( {a_{t,m},{\max\left( {o,{e - 1 - {\sum\limits_{n - 1}^{m - 1}\; a_{t,n}}}} \right)}} \right)} \cdot \gamma_{m}}}}} & (12) \\{t\left\{ \begin{matrix}{1\left( {1 \leqq c \leqq n_{1}} \right)} \\{2\left( {{n_{1} + 1} \leqq c \leqq {n_{1} + n_{2}}} \right)} \\{\mspace{124mu}\vdots} \\{t_{m}\left( {{{\sum\limits_{i = 1}^{{tm} - 1}\; n_{i}} + 1} \leqq c \leqq {\sum\limits_{i = 2}^{tm}\; n_{i}}} \right)}\end{matrix} \right.} & (13)\end{matrix}$

The division processing explained in items (1) to (4) is described belowwith a specific example. For example, the row number of “1” in thecolumn of c=1-st of AG(2, 2³) is defined as G₁₆={10 16 18 23 35 38 3949}. FIG. 6 depicts a division procedure performed by the Latin squarematrix of the random sequence. When the procedure (5) is performed bythe result of the Latin square matrix, “1” in the new column g_(16,e)can be expressed by the following equation (14).g _(16,1)′(1)=g ₁₆′(L _(2,8)(1))=g ₁₆′(3)=18g _(16,1)′(2)=g ₁₆′(L _(2,8)(2))=g ₁₆′(2)=16g _(16,2)′(1)=g ₁₆′(L _(2,8)(3))=g ₁₆′(8)=49g _(16,2)′(2)=g ₁₆′(L _(2,8)(4))=g ₁₆′(7)=39g _(16,3)′(1)=g ₁₆′(L _(2,8)(5))=g ₁₆′(6)=38g _(16,3)′(2)=g ₁₆′(L _(2,8)(6))=g ₁₆′(1)=10g _(16,4)′(1)=g ₁₆′(L _(2,8)(7))=g ₁₆′(4)=23g _(16,4)′(2)=g ₁₆′(L _(2,8)(8))=g ₁₆′(5)=35   (14)

As a result, the 16th column is, divided as follows:G_(16,1)={18 16}G_(16,2)={49 39}G_(16,3)={38 10}G_(16,4)={23 35}

As described above, the deterministic, stable-characteristics checkmatrix H(n×k) for the “Irregular-LDPC code” can be created by performingthe method of forming the “Irregular-LDPC code” based on the affinefinite geometry (FIG.2A, step S1).

After the parity check matrix H and the creation matrix G and G⁻¹(G⁻¹·G=I: unit matrix) are created in the above manner, in thecommunication apparatus on the transmission side, a random numbergeneration unit 11 generates the random number sequence (sequence of 1and 0: transmission data) and randomly determines the transmission code(+: the code corresponding to the measuring apparatus that can identifythe light polarized in the horizontal direction from the light polarizedin the vertical direction, ×: the code corresponding to the measuringapparatus that can identify the light polarized in the obliquedirection) (step S2). On the other hand, in the communication apparatuson the reception side, a random number generation unit 31 randomlydetermines a reception code (+: the code corresponding to the measuringapparatus that can identify the light polarized in the horizontaldirection from the light polarized in the vertical direction, and ×: thecode corresponding to the measuring apparatus that can identify thelight polarized in the oblique direction) (step S12).

In the communication apparatus on the transmission side, a photoncreation unit 12 transmits the photon in the polarized directionautomatically determined by the combination of the random numbersequence and the transmission code (step S3). For example, the lightpolarized in the horizontal direction by the combination of 0 and +, thelight polarized in the vertical direction by the combination of 1 and +,the light polarized in the 45° direction by the combination of 0 and ×,and the light polarized in the 135° direction by the combination of 1and × are transmitted to the quantum communication path respectively(transmission signal).

In the communication apparatus on the reception side, a photon receivingunit 32 that has received the light signal generated from the photoncreation unit 12 measures the light on the quantum communication channel(reception signal). The photon receiving unit 32 obtains the receptiondata automatically determined by the combination of the reception codeand the reception signal (step S13). In this case, 0 is obtained as thereception data by the combination of the light polarized in thehorizontal direction and +, 1 is obtained as the reception data by thecombination of the light polarized in the vertical direction and +, 0 isobtained as the reception data by the combination of the light polarizedin the 45° direction and ×, and 0 is obtained as the reception data bythe combination of the light polarized in the 135° direction and ×respectively.

In the communication apparatus on the reception side, the random numbergeneration unit 31 transmits the reception code to the communicationapparatus on the transmission side through the public communication pathin order to check whether the measurement has been performed with anappropriate measuring apparatus (step S13). When the communicationapparatus on the transmission side receives the reception code, thecommunication apparatus on the transmission side checks whether themeasurement has been performed with an appropriate measuring apparatus.The transmitter transmits the result to the communication apparatus onthe reception side through the public communication path (step S3). Thecommunication apparatus on the reception side and the communicationapparatus on the transmission side save only the data corresponding tothe reception signal which has received with the appropriate measuringapparatus and discard other pieces of the reception data (step S3 andstep S13). The saved data is then stored in the memory or the like, andthe n bits of the data are sequentially read out from the front end ofthe data to create transmission data m_(A) and reception data m_(B)(m_(B) is m_(A) which is affected by the noise and the like on thetransmission path). Namely, the next n bits are read out after eachcompletion of the common key creation processing, and the transmissiondata m_(A) and the reception data m_(B) are created in each case. Inthis embodiment, the position of the bit corresponding to the receptionsignal received by the appropriate measuring apparatus can be sharedbetween the communication apparatus on the transmission side and thecommunication apparatus on the reception side.

In the communication apparatus on the transmission side, a syndromecreation unit 14 calculates syndrome S_(A)=Hm_(A) of m_(A) by the paritycheck matrix H(n×k) and the transmission data m_(A) and notifies apublic communication path communication unit 13 and the communicationapparatus on the reception side of the result through the publiccommunication path (step S4). At this step, there is a possibility thatthe syndrome S_(A) of m_(A) (information of k bits) is known by theinterceptor. On the other hand, in the communication apparatus on thereception side, public communication path communication unit 34 receivesthe syndrome S_(A) of m_(A) and notifies a syndrome decoding unit 33 ofthe syndrome S_(A) of m_(A) (step S14).

The syndrome decoding unit 33 calculates syndrome S_(B)=Hm_(B) of m_(B)by the parity check matrix H and the reception data m_(B) and furthercalculates syndrome S=S_(A)+S_(B) by the syndrome S_(A) of m_(A) and thesyndrome S_(B) of m_(B) (step S15). The syndrome decoding unit 33estimates transmission data m_(A) based on the syndrome S (step S16). Atthis point, it is assumed that m_(A)=m_(A)+e (noise and the like) andthe syndromes is deformed as shown in the equation (15). “e” isaccordingly obtained by syndrome decoding, and the transmission datam_(A) is obtained (step S16). “+” of S=S_(A)+S_(B) and m_(A)+e indicatesexclusive OR.

$\quad\begin{matrix}\begin{matrix}{S = {S_{A} + S_{B}}} \\{= {{Hm}_{A} + {Hm}_{B}}} \\{= {H\left( {m_{A} + m_{B}} \right)}} \\{= {H\left( {m_{A} + m_{A} + e} \right)}} \\{= {HE}}\end{matrix} & (15)\end{matrix}$

Finally, In the communication apparatus on the reception side, a commonkey creation unit 35 discards a part of pieces of the common information(m_(A)) according to the public error correction information (theinformation of k bits having a possibility of the intercept: S_(A)) andcreates the cryptographic key r including the amount of information ofn−k bits (step S17). Namely, the common key creation unit 35 creates thecryptographic key r from the following equation (16) by the G⁻¹(n×(n−k)) which is calculated in advance. The communication apparatus onthe reception side shares the cryptographic key r with the communicationapparatus on the transmission side.r=G⁻¹m_(A)   (16)

On the other hand, in the communication apparatus on the transmissionside, a common key creation unit 15 discards a part of pieces of thecommon-information (m_(A)) according to the public error correctioninformation (the information of k bits having a possibility of theintercept: S_(A)) and creates the cryptographic key r including theamount of information of n−k bits (step S5). Namely, the common keycreation unit 15 creates the cryptographic key r from the followingequation (16) by the G⁻¹(n×(n−k)) which is calculated in advance (stepS5). The communication apparatus on the transmission side shares thecryptographic key r with the communication apparatus on the receptionside.

As described above, in this embodiment, the data error of the commoninformation is corrected by the deterministic, stable-characteristicsparity check matrix H(n×k) for the “Irregular-LDPC code” and a part ofpieces of the common information is discarded according to the publicerror correction information. Accordingly, the huge number of exchangesof the parity for specifying and correcting the error bit is avoided anderror correction control is performed only by transmitting the errorcorrection information, so that the time for the error correctionprocessing is considerably reduced. Further, since a part of pieces ofthe common information is discarded according to the public errorcorrection information, the highly-secured common key can be created.

In this embodiment, the inverse matrix G⁻¹(n×(n−k)) which becomesG⁻¹·G=I (unit matrix) is created from the creation matrix G(n×(n−k))satisfying HG=0, a part (k) of pieces of the common information (n) isdiscarded by the inverse matrix G⁻¹, and the cryptographic key rincluding the amount of information of n−k bits. However, the inventionis not limited to the embodiment, and a part of pieces of the commoninformation (n) may be discarded and the cryptographic key r includingthe amount of information of m bits (m≦n−k). Specifically, a mappingF(·) which maps an n-dimensional vector to an m-dimensional vector isassumed. In order to secure the common key, it is necessary that F(·)satisfies the condition that “the number of elements of a reverse image(F·G)⁻¹(v) in a composition mapping F·G of the mapping F and thecreation matrix G is independent of an arbitrary m-dimensional vector vand is constant(2^(n−k−m)).” At this point, the cryptographic key rbecomes r=F(m_(A)).

SECOND EMBODIMENT

In the second embodiment, confidentiality of the cryptographic key raccording to the first embodiment is further enhanced.

FIG. 7 depicts a configuration of the quantum cryptosystem according tothe second embodiment of the invention. Like parts of the configurationas the first embodiment are designated by like reference numerals, andthe description of like constituents is omitted. In order to enhance theconfidentiality against the information intercepted on the quantumcommunication path, it is necessary that the information of the bitsintercepted is compressed by a hash function. However, the hash functionhas some positions where interceptions can be easily made, depending oncharacteristics of the hash function. Therefore, this embodiment dealswith intercepts of the hash function by randomly rearranging theposition.

FIG. 8 is a flowchart of the quantum key distribution of the secondembodiment, particularly depicts the processing of the communicationapparatus-on the transmission side. In the communication apparatus onthe transmission side, a random permutation unit 16 creates anonsingular random matrix R((n−k)×(n−k)), notifies the common keycreation unit 15 of R, and further notifies the common key creation unit35 in the communication on the transmission side of R through the publiccommunication path (step S6). In FIGS. 7 and 8, although the randommatrix is created and transmitted in the communication apparatus on thetransmission side, as an example, it is also possible that theprocessing is performed in the communication apparatus on the receptionside.

In the communication apparatus on the transmission side, the common keycreation unit 15 discards a part of pieces of the common information(m_(A)) according to the public error correction information (theinformation of k bits having a possibility of the intercept: S_(A)),enhances the confidentiality by the received random matrix R, andcreates the cryptographic key r including the amount of information ofn−k bits (step S5). Namely, the common key creation unit 15 creates thecryptographic key r from the following equation (17) by the receivedrandom matrix R((n−k)×(n−k)) and the G⁻¹(n×(n−k)) which is calculated inadvance (step S5). The communication apparatus on the transmission sideshares the cryptographic key r with the communication apparatus on thereception side.r=RG⁻¹m_(A)   (17)

On the other hand, in the communication apparatus on the reception side,the common key creation unit 35 also discards a part of pieces of thecommon information (m_(A)) according to the public error correctioninformation (the information of k bits having a possibility of theintercept: S_(A)), enhances the confidentiality by the received randommatrix R, and creates the cryptographic key r including the amount ofinformation of n−k bits (step S17). Namely, the common key creation unit15 creates the cryptographic key r from the following equation (17) bythe received random matrix R((n−k)×(n−k)) and the G⁻¹(n×(n−k)) which iscalculated in advance (step S17). The communication apparatus on thereception side sets the cryptographic key r to the common key which isshared with the communication apparatus on the transmission side.

As described above, in this embodiment, the data error of the commoninformation is corrected by the deterministic, stable-characteristicsparity check matrix H(n×k) for the “Irregular-LDPC code,” a part ofpieces of the common information is discarded according to the publicerror correction information, and the common information is rearrangedby the nonsingular random matrix. Therefore, the huge number ofexchanges of the parity for specifying and correcting the error bit isavoided and error correction control is performed only by transmittingthe error correction information, so that the time for the errorcorrection processing is considerably reduced. Since a part of pieces ofthe common information is discarded according to the public errorcorrection information, the highly-secured common key can be created.Further, since the common information is rearranged by the nonsingularrandom matrix, the confidentiality can be enhanced.

In this embodiment, similarly to the first embodiment, it is alsopossible that a part of pieces of the common information (n) isdiscarded and the cryptographic key r including the amount ofinformation of m bits (m≦n−k). In this case, the common key becomesr=RF(m_(A)).

THIRD EMBODIMENT

In the first embodiment, a part of pieces of the common information isdiscarded by the inverse matrix G⁻¹ of the creation matrix G. On thecontrary, in the third embodiment, a part of pieces of the commoninformation is discarded without using the inverse matrix G⁻¹ of thecreation matrix by the characteristics of the parity check matrix H. Theconfiguration of this embodiment is similar to the first embodimentshown in FIG. 1.

The quantum key distribution according to the third embodiment isdescribed below. Only the processing different from the processing inFIG. 2 is described.

In the communication apparatus on the transmission side and thecommunication apparatus on the reception side, the parity check matrixcreation units 10 and 30 determine the parity check matrix H(n×k) of thespecific linear code (step S1 and step S11). The method of forming the“Irregular-LDPC code” based on the affine finite geometry (Details ofstep S1 in FIG. 2) is similar to the first embodiment shown in FIG. 3.

After step S2 to step S4 are performed in the same procedure as thefirst embodiment, in the communication apparatus on the reception side,the common key creation unit 35 discards a part of pieces of the commoninformation (m_(A)) according to the public error correction information(the information of k bits having a possibility of the intercept: S_(A))and creates the cryptographic key r including the amount of informationof n−k bits (step S17). Specifically, the common key creation unit 35performs the random permutation to the column of the parity check matrixcreated in step S11. The common key creation unit 35 then exchanges theinformation concerning the bit discarded with the communicationapparatus on the transmission side through the public communicationpath. In this case, the common key creation unit 35 selects the specific“1” from the first column of the original finite affine geometryAG(2,2^(S)) and exchanges the position of “1” with the communicationapparatus on the transmission side through the public communicationpath.

The common key creation unit 35 then specifies the position after thedivision corresponding to the “1” and the position after the divisioncorresponding to the “1” in each cyclically-shifted column from theparity check matrix after the random permutation, discards the bit inthe common information m_(A) corresponding to the specified positions,and makes the saved data the cryptographic key r. The communicationapparatus on the reception side sets the cryptographic key r to thecommon key which is shared with the communication apparatus on thetransmission side.

On the other hand, in the communication apparatus on the transmissionside, the common key creation unit 15 discards a part of pieces of thecommon information (m_(A)) according to the public error correctioninformation (the information of k bits having a possibility of theintercept: S_(A)) and creates the cryptographic key r including theamount of information of n−k bits (step S5). Specifically, the commonkey creation unit 15 performs the similar random permutation to thecolumn of the parity check matrix created in step S1. The common keycreation unit 15 then exchanges the information concerning the bitdiscarded with the communication apparatus on the reception side throughthe public communication path.

The common key creation unit 15 then specifies the position after thedivision corresponding to the “1” and the position after the divisioncorresponding to the “1” in each cyclically-shifted column from theparity check matrix after the random permutation, discards the bit inthe common information m_(A) corresponding to the specified positions,and makes the saved data the cryptographic key r. The communicationapparatus on the transmission side sets the cryptographic key r to thecommon key which is shared with the communication apparatus on thereception side.

As described above, in the third embodiment, a part of pieces of thecommon information is discarded without using the inverse matrix G⁻¹ ofthe creation matrix by the characteristics of the parity check matrix H.Accordingly, the same advantage as the first embodiment can be obtained,and the complicated creation matrix G and the complicated inverse matrixG⁻¹ can be deleted.

In this embodiment, it is also possible that a part of pieces of thecommon information is discarded by the characteristics of the paritycheck matrix H and, similarly to the second embodiment, the commoninformation is rearranged by the nonsingular random matrix. Therefore,the confidentiality can be enhanced.

As described above, according to the present invention, the data errorof the common information is corrected by the deterministic,stable-characteristics parity check matrix H(n×k) for the“Irregular-LDPC code” and a part of pieces of the common information isdiscarded according to the public error correction information.Accordingly, the present invention has the advantage that the hugenumber of exchanges of the parity for specifying and correcting theerror bit is avoided and error correction control is performed only bytransmitting the error correction information, so that the time for theerror correction processing is considerably reduced. Further, theinvention has the advantage that highly-secured common key can becreated because a part of pieces of the common information is discardedaccording to the public error correction information.

INDUSTRIAL APPLICABILITY

As described above, the quantum key distribution method and thecommunication apparatus are useful for the quantum cryptosystem whichuses the photon as the communication medium, particularly suitable tothe apparatus that creates the highly-secured common key.

1. A quantum key distribution method employed on a quantum cryptosystemincluding a first communication apparatus that transmits photons onto aquantum communication path and a second communication apparatus thatmeasures the photons, comprising: a check matrix creation step of eachof the first communication apparatus and the second communicationapparatus creating the same parity check matrices H(n×k); a randomnumber generation step of the first communication apparatus generating arandom number sequence (transmission data) and randomly determining apredetermined transmission code (base) by the first communicationapparatus, and the second communication apparatus randomly determining apredetermined reception code (base); a photon transmission step of thefirst communication apparatus transmitting a photon onto the quantumcommunication path while the photon is in a quantum state specified by acombination of the transmission data and the transmission code; a photonreception step of the second communication apparatus measuring thephoton transmitted on the quantum communication path to obtain receptiondata specified by the combination of the reception code and measurementresult; a data deletion step of each of the first communicationapparatus and the second communication apparatus deciding whether themeasuring has been performed with an appropriate measuring apparatus,saving the reception data of n bits if the measuring has been performedwith the appropriate measuring apparatus and transmission data thatcorresponds to the reception data, and discarding other pieces of thedata; an error correction information notification step of the firstcommunication apparatus notifying the second communication apparatusthrough a public communication path of error correction information of kbits based on the parity check matrix H and the transmission data of nbits; an error correction step of the second communication apparatuscorrecting the error of the reception data based on the parity checkmatrix H, the reception data of n bits, and the error correctioninformation; and a cryptographic key creation step of each of the firstcommunication apparatus and the second communication apparatusdiscarding a part of pieces of the common information after correctionaccording to public error correction information, creating acryptographic key using information that has remained after discarding,wherein the amount of information remaining is n−k bits, and setting thecryptographic key as a common key which is shared between firstcommunication apparatus and the second communication apparatus.
 2. Thequantum key distribution method according to claim 1, wherein the checkmatrix creation step includes: weight searching step of using finiteaffine geometry as a basic matrix and searching optimum row and columnweight distributions of the parity check matrix by performingoptimization of Gaussian approximation; and dividing step of dividingrandomly the row and column weights of the finite affine geometry basedon the optimum weight distribution by a predetermined procedure, andcreating the parity check matrix H of a low-density parity check code inwhich both the row and column weights or one of the row and columnweights is not uniform.
 3. The quantum key distribution method accordingto claim 2, wherein the cryptographic key creation step includesperforming random permutation to the column of the parity check matrixH, selecting specific “1” in the first column of finite affine geometryAG(2,2^(S)) of a creation element of the parity check matrix H,exchanges a position of “1” through a public communication path,specifying the position (column) after the division corresponding to “1”from the parity check matrix after the random permutation and theposition (column) after the division corresponding to “1” in eachcyclically shifted column, and discarding the part of pieces of thecommon information corresponding to the specified position (column). 4.The quantum key distribution method according to claim 3, wherein thecryptographic key creation step includes: one of the communicationapparatuses, out of the first communication apparatus and the secondcommunication apparatus, creating a nonsingular random matrixR((n−k)×(n−k)) to act on the cryptographic key after discarding the partof pieces of the common information and informing the nonsingular randommatrix R to other one of the communication apparatuses through thepublic communication path, the first communication apparatus and thesecond communication apparatus using the nonsingular random matrix R tocreate the cryptographic key.
 5. The quantum key distribution methodaccording to claim 1, wherein the check matrix creation step includescreating an inverse matrix G⁻¹(n×(n−k)), which satisfies G⁻¹·G=I (unitmatrix), from a creation matrix G((n−k)×n) satisfying “HG=0;” and thecryptographic key creation step includes discarding the part of piecesof the common information by the inverse matrix G⁻¹.
 6. The quantum keydistribution method according to claim 5, wherein the cryptographic keycreation step includes: one of the communication apparatuses, out of thefirst communication apparatus and the second communication apparatus,creating a nonsingular random matrix R((n−k)×(n−k)) to act on thecryptographic key after discarding the part of pieces of the commoninformation and informing the nonsingular random matrix R to other oneof the communication apparatuses through the public communication path,the first communication apparatus and the second communication apparatususing the nonsingular random matrix R to create the cryptographic key.7. The quantum key distribution method according to claim 1, wherein thecheck matrix creation step includes creating a mapping F to map ann-dimensional vector to an m-dimensional vector (m≦n−k), the mapping Fbeing one in which the number of elements of a reverse image (F·G)⁻¹(v)in a composition mapping F·G of the mapping F and the creation matrix Gsatisfying “HG=0” is independent of an arbitrary m-dimensional vector vand is constant(2^(n−k−m)), and the cryptographic key creation stepincludes discarding the part of pieces of the common information by themapping F.
 8. The quantum key distribution method according to claim 7,wherein the cryptographic key creation step includes: one of thecommunication apparatuses, out of the first communication apparatus andthe second communication apparatus, creating a nonsingular random matrixR((n−k)×(n−k)) to act on the cryptographic key after discarding the partof pieces of the common information and informing the nonsingular randommatrix R to other one of the communication apparatuses through a publiccommunication path, the first communication apparatus and the secondcommunication apparatus using the nonsingular random matrix R to createthe cryptographic key.
 9. A communication apparatus on transmission sidethat transmits photons onto a quantum communication path, comprising: acheck matrix creation unit that creates a parity check matrix H(n×k)identical to a communication apparatus on reception side; a transmissionunit that generates a random number sequence (transmission data),randomly determines a predetermined transmission code (base), transmitsthe photon onto the quantum communication path while the photon is in aquantum state specified by a combination of the transmission data andthe transmission code, decides whether the measuring has been performedwith an appropriate measuring apparatus in the communication apparatuson the reception side, saves the transmission data of n bits if themeasuring has been performed with the appropriate measuring apparatus,and discards other pieces of the transmission data; an error correctioninformation notifying unit that notifies the communication apparatus onthe reception side of error correction information of k bits based onthe parity check matrix H and the transmission data of n bits through apublic communication path; and a cryptographic key creation unit thatdiscards a part (k) of pieces of the common information after errorcorrection according to public error correction information, creates acryptographic key using information that has remained after discarding,wherein the amount of information remaining is n−k bits, and sets thecryptographic key as a common key which is shared with the communicationapparatus on the reception side.
 10. The communication apparatusaccording to claim 9, wherein the check matrix creation unit uses finiteaffine geometry as a basic matrix, searches optimum row and columnweight distributions of the parity check matrix by performingoptimization of Gaussian approximation; divides randomly the row andcolumn weights of the finite affine geometry based on the optimum weightdistribution by a predetermined procedure; and creates the parity checkmatrix H of a low-density parity check code in which both the row andcolumn weights or one of the row and column weights is not uniform. 11.The communication apparatus according to claim 10, wherein thecryptographic key creation unit performs random permutation to thecolumn of the parity check matrix H, selects specific “1” in the firstcolumn of finite affine geometry AG(2,2^(S)) of a creation element ofthe parity check matrix H, exchanges a position of “1” through thepublic communication path, specifies the position (column) after thedivision corresponding to “1” from the parity check matrix after therandom permutation and the position (column) after the divisioncorresponding to “1” in each cyclically shifted column, and discards thepart of pieces of the common information corresponding to the specifiedposition (column).
 12. The communication apparatus according to claim11, wherein the cryptographic key creation unit uses a nonsingularrandom matrix R((n−k)×(n−k)) as the cryptographic key after discardingthe part of pieces of the common information.
 13. The communicationapparatus according to claim 9, wherein the check matrix creation unitfurther creates an inverse matrix G⁻¹(n×(n−k)), which satisfies G⁻¹·G=I(unit matrix), from a creation matrix G((n−k)×n) satisfying “HG=0;” andthe cryptographic key creation unit discards the part of pieces of thecommon information by the inverse matrix G⁻¹.
 14. The communicationapparatus according to claim 13, wherein the cryptographic key creationunit uses a nonsingular random matrix R((n−k)×(n−k)) as thecryptographic key after discarding a part of pieces of the commoninformation.
 15. The communication apparatus according to claim 9,wherein the check matrix creation unit further creates a mapping F tomap an n-dimensional vector to an m-dimensional vector (m≦n−k), themapping F being one in which the number of elements of a reverse image(F·G)⁻¹(v) in a composition mapping F·G of the mapping F and thecreation matrix G satisfying “HG=0” is independent of an arbitrarym-dimensional vector v and is constant(2^(n−k−m)); and the cryptographickey creation unit discards the part of pieces of the common informationby the mapping F.
 16. The communication apparatus according to claim 15,wherein the cryptographic key creation unit uses a nonsingular randommatrix R((n−k)×(n−k)) as the cryptographic key after discarding the partof pieces of the common information.
 17. A communication apparatus onreception side that measures photons on a quantum communication path,comprising: a check matrix creation unit that creates a parity checkmatrix H(n×k) identical to a communication apparatus on transmissionside; a receiving unit that randomly determines a predeterminedreception code (base), measures the photons on the quantum communicationpath, reproduces reception data specified by a combination of thereception code and measurement result, decides whether the measuring hasbeen performed with an appropriate measuring apparatus, saves thereception data of n bits if the measuring has been performed with theappropriate measuring apparatus, and discards other pieces of thereception data; an error correction unit that corrects the error ofreception data based on error correction information of k bits receivedthrough a public communication path, the parity check matrix H, and thereception data of n bits; and a cryptographic key creation unit thatdiscards a part of pieces of the common information after errorcorrection according to public error correction information, creates acryptographic key using information that has remained after discarding,wherein the amount of information remaining is n−k bits, and sets thecryptographic key as a common key which is shared with the communicationapparatus on the transmission side.
 18. The communication apparatusaccording to claim 17, wherein the check matrix creation unit usesfinite affine geometry as a basic matrix, searches optimum row andcolumn weight distributions of the parity check matrix by performingoptimization of Gaussian approximation; divides randomly the row andcolumn weights of the finite affine geometry based on the optimum weightdistribution by a predetermined procedure; and creates the parity checkmatrix H of a low-density parity check code in which both the row andcolumn weights or one of the row and column weights is not uniform. 19.The communication apparatus according to claim 18, wherein thecryptographic key creation unit performs random permutation to thecolumn of the parity check matrix H, selects specific “1” in the firstcolumn of finite affine geometry AG(2,2^(S)) of a creation element ofthe parity check matrix H, exchanges a position of “1” through thepublic communication path, specifies the position (column) after thedivision corresponding to “1” from the parity check matrix after therandom permutation and the position (column) after the divisioncorresponding to “1” in each cyclically shifted column, and discards apart of pieces of the common information corresponding to the specifiedposition (column).
 20. The communication apparatus according to claim19, wherein the cryptographic key creation unit uses a nonsingularrandom matrix R((n−k)×(n−k)) as the cryptographic key after discardingthe part of pieces of the common information.
 21. The communicationapparatus according to claim 17, wherein the check matrix creation unitfurther creates an inverse matrix G⁻¹(n×(n−k)), which satisfies G⁻¹·G=I(unit matrix), from a creation matrix G((n−k)×n) satisfying “HG=0;” andthe cryptographic key creation unit discards a part of pieces of thecommon information by the inverse matrix G⁻¹.
 22. The communicationapparatus according to claim 21, wherein the cryptographic key creationunit uses a nonsingular random matrix R((n−k)×(n−k)) as thecryptographic key after discarding a part of pieces of the commoninformation.
 23. The communication apparatus according to claim 17,wherein the check matrix creation unit further creates a mapping F tomap an n-dimensional vector to an m-dimensional vector (m≦n−k), themapping F being one in which the number of elements of a reverse image(F·G)⁻¹(v) in a composition mapping F·G of the mapping F and thecreation matrix G satisfying “HG=0” is independent of an arbitrarym-dimensional vector v and is constant(2^(n−k−m)); and the cryptographickey creation unit discards the part of pieces of the common informationby the mapping F.
 24. The communication apparatus according to claim 23,wherein the cryptographic key creation unit uses a nonsingular randommatrix R((n−k)×(n−k)) as the cryptographic key after discarding the partof pieces of the common information.